Уязвимость CVE-2019-7317: Информация

Описание

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

Важность: MEDIUM (5,3) Вектор: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Исправленные пакеты

Ссылки на рекомендации, решения и инструменты

1. Подверженные конфигурации:

   1. Конфигурация 1

      cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*

      Start including

      1.6.0

      End excliding

      1.6.37

      ---

      Конфигурация 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      ---

      Конфигурация 3

      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

      ---

      Конфигурация 4

      cpe:2.3:a:oracle:jdk:11.0.3:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:oracle:jdk:12.0.1:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:oracle:java_se:8u212:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:oracle:java_se:7u221:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*

      End excliding

      8.0.23

      ---

      cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.6.0:*:*:*:*:*:*:*

      ---

      Конфигурация 5

      cpe:2.3:a:hpe:xp7_command_view_advanced_edition_suite:*:*:*:*:*:*:*:*

      End excliding

      8.7.0-00

      ---

      cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:*

      End excliding

      8.7.0-00

      ---

      Конфигурация 6

      cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:mozilla:firefox_esr:-:*:*:*:*:*:*:*

      ---

      Конфигурация 7

      cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

      ---

      Конфигурация 8

      cpe:2.3:a:opensuse:package_hub:-:*:*:*:*:*:*:*

      ---

      Running on/with:

      cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*

      ---

      Конфигурация 9

      cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:netapp:steelstore:-:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:vcenter:*:*

      ---

      cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*

      End excliding

      3.4.2

      ---

      cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:*

      End excliding

      3.4.2

      ---

      cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:sap:*:*

      ---

      cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:oracle:*:*

      ---

      cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:vmware_vsphere:*:*

      ---

      cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*

      End excliding

      9.6

      ---

      cpe:2.3:a:netapp:e-series_santricity_storage_manager:*:*:*:*:*:*:*:*

      End excliding

      11.53

      ---

      cpe:2.3:a:netapp:oncommand_insight:*:*:*:*:*:*:*:*

      End excliding

      7.3.9

      ---

      cpe:2.3:a:netapp:e-series_santricity_unified_manager:*:*:*:*:*:*:*:*

      End excliding

      3.2

      ---

      cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*

      End excliding

      9.6

      ---

      cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:windows:*:*

      ---

      cpe:2.3:a:netapp:oncommand_workflow_automation:*:*:*:*:*:*:*:*

      End excliding

      5.1

      ---

      cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:*

      End excliding

      4.0

      ---

      Конфигурация 10

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*

      ---